Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add several improvements, and merge PR2, PR6 #9

Open
wants to merge 43 commits into
base: main
Choose a base branch
from

Conversation

Eliot-Roxbergh
Copy link

I merged PRs and added several improvements and documentation.
I hope it could be of help to someone.

Changelog

Merge pull requests

Build

  • Remove .python-version to avoid forcing old Python
  • Use latest dependencies in requirements.txt, and add related fixes to ensure it builds on Ubuntu 24.04.

New features

  • Use also manual connection scan (in addition to the SDP scan) when looking for services in commandline mode.
  • Add function ensure_bluetooth_up that restarts bluetooth until an adapter is found, as reset_bluetooth may not always bring the adapter back up.
  • Automatically run adb logcat on each hard crash, if possible, and save the last 5000 entries to .log file on disk.
    This results in the original (.wrt) logfile per target port, as well as a new (.adb.log) file with the logcat dump for each hard crash.
    To determine which run (.wrt file) resulted in a specific hard crash (.adb.log), grep for the timestamp in the filename to find the corresponding entry in the .wrt log for the run.
  • Add command "scan-only" to only list all discovered services in commandline mode, without fuzzing.
  • Add Bash script to automatically fuzz all ports that were discovered as open on target.
    This was done in a Bash script to avoid using state from earlier fuzzing rounds as it otherwise would be run in the same single Python process.

Exceptions and failure behavior

  • Ignore several exceptions and try to continue anyway (add time.sleep, and restart bluetooth adapter or reset socket/state machine when necessary), to avoid fuzzing failing early. For some major unexpected exception the fuzzer will be retried up to five times (arbitrary number), until it gives up.
  • Instead of defaulting to PSM/port 1 on connection error, continue using the requested port, to avoid confusion. Note that you may want to troubleshoot this error still.

Logging

  • Instead of log truncation which deletes a lot of the logs, simple log everything but limit each run to 50 million packets (!) (as this limits the file to about 1-2GB).
  • Clarify print outs and comments regarding which crashes are "soft" and can be ignored, or "hard" which are the ones written to log.
  • Update log filename to contain the port that user requested (note: as normally, the program still scans other ports as well, which are still saved to this file, these packets are still differentiated by the psm field that holds the port used for that specific packet)
  • Save timestamp earlier after a crash to get slightly better precision.

Other

  • Update README to use venv, and add Details and Recommendations

Eliot-Roxbergh and others added 30 commits February 12, 2025 15:29
Update import statement to support most recent ouilookup in pip. This version 0.3.1 was released in May 13, 2023.

According to ndejong/ouilookup#3, to avoid import issue.
1. If we support only L2CAP, don't show profiles that don't work
2. Spelling
* Added .gitignore;
* Added environment normalization files;
* Minor bug fix in index input exception handling;

---------

Co-authored-by: Ashwinkumar Pillai <[email protected]>
…(for ouilookup, pybluez, scapy)

I hope this doesn't break anything! Seems to work fine.
Do not delete logs and instead limit max log entries to 50 million, i.e. about 1-2GB on disk.
Change this limit to run more than 50m fuzzing iterations
Previously, if the one-time check fails, the fuzzer changes target port
to 1. This may not be clear to user, and it's better to allow user to
decide what target to fuzz! imo.
Besides, no check was/is done to ensure that the new port 1 communication is successful,
which creates confusing patterns, like:
"cannot communicate with port 1! Defaulting to port 1".
…vices

'all': Command all did not work as intended, there seems to be persistent state in the fuzzing module. Removing.
'scan-only': Add command to only detect all networks, without fuzzing
find_all_services: Add functionality to search by manual connections, in addition to SDP scan, thereby possibly finding unannounced services on target
Since the Python process seems to maintain state, use a separate Bash script to loop over all services detected. Enabling fully automatic fuzz on target
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants